Blog
Notes on web application security testing from the team building Hugin.
What Burp Suite Community leaves out
Community Edition is free and good. It is also missing the scanner, has a throttled Intruder, and no Collaborator. Here is exactly what you get, and the free paths around each limit.
Why your scanner gets blocked: TLS fingerprints
Before a WAF reads your payload, it can already tell what client sent it. Here is what a TLS fingerprint is, and why rotating the User-Agent changes nothing.
HTTP request smuggling, explained without the jargon
How CL.TE and TE.CL desyncs work, why they need two HTTP servers that disagree, and what an attacker gains when they land.
Testing for BOLA and IDOR without guessing
Broken object-level authorisation is the most common API bug and the easiest to test properly — if you set it up as an experiment with two accounts.
What the vulnerability scanner ships in 2026
Which vulnerability classes Hugin's scanner actually tests, what the passive engine catches without sending a request, and what the numbers mean.
Race conditions, explained with a coupon
How single-packet attacks beat check-then-act windows, and how to tell a real race from a flaky test.